Analysis
- max time kernel
144s - max time network
121s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 10:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe
- Size 408KB
- Sample240613-mzdp8awamd
- SHA256 8d16ce13c939ae09da1bb01fc5713e768367eee602346cc5fa41823bc9e526a1
- MD5 83e7ec18f0949f9c29932aa12a831797
- SHA1 7c46130e86a22b45a6c45638a0d49f973d447419
- SHA512 b43b9dbe41e25375cafb06ca2e88318ff021a2685cb10f0c9e798f341d39c2039303fc7b9eb903b3924e75d716e769000444d73ceb6c3baf6d3e0d13ca2bff0c
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG8ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral1/files/0x000c0000000132ef-4.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001c000000015c98-12.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000d0000000132ef-19.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0004000000004ed7-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000e0000000132ef-33.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001b000000015ca0-40.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0009000000015caf-47.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x001c000000015ca0-54.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000a000000015caf-61.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x0007000000015cc3-68.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral1/files/0x000b000000015caf-75.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6} {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4E8297F-93CC-4e91-B64A-F2350D823F15}\stubpath = "C:\\Windows\\{D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe" {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7BABA1F-5B31-4f25-8E38-39816B5707C4} {BAF69FB7-E329-4233-A00B-5EA794D06066}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8} {A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98425FC2-9954-4844-B6DA-6E617E0F6D05}\stubpath = "C:\\Windows\\{98425FC2-9954-4844-B6DA-6E617E0F6D05}.exe" {7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}\stubpath = "C:\\Windows\\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe" {A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F897AE52-9247-4857-B642-F195214BD8A5} 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F897AE52-9247-4857-B642-F195214BD8A5}\stubpath = "C:\\Windows\\{F897AE52-9247-4857-B642-F195214BD8A5}.exe" 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51E0C171-92DF-4a92-9072-C79138278B0C}\stubpath = "C:\\Windows\\{51E0C171-92DF-4a92-9072-C79138278B0C}.exe" {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36D049AE-D479-4b58-BA35-2B1D580BD761} {51E0C171-92DF-4a92-9072-C79138278B0C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36D049AE-D479-4b58-BA35-2B1D580BD761}\stubpath = "C:\\Windows\\{36D049AE-D479-4b58-BA35-2B1D580BD761}.exe" {51E0C171-92DF-4a92-9072-C79138278B0C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}\stubpath = "C:\\Windows\\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe" {BAF69FB7-E329-4233-A00B-5EA794D06066}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98425FC2-9954-4844-B6DA-6E617E0F6D05} {7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}\stubpath = "C:\\Windows\\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe" {F897AE52-9247-4857-B642-F195214BD8A5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED5F4092-F0D8-4228-9B7F-2A64030E7049} {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}\stubpath = "C:\\Windows\\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe" {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51E0C171-92DF-4a92-9072-C79138278B0C} {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}\stubpath = "C:\\Windows\\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe" {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAF69FB7-E329-4233-A00B-5EA794D06066} {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303} {F897AE52-9247-4857-B642-F195214BD8A5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4E8297F-93CC-4e91-B64A-F2350D823F15} {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BAF69FB7-E329-4233-A00B-5EA794D06066}\stubpath = "C:\\Windows\\{BAF69FB7-E329-4233-A00B-5EA794D06066}.exe" {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe - Deletes itself 1 IoCs
pid Process 1692 cmd.exe - Executes dropped EXE 11 IoCs
pid Process 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 1556 {BAF69FB7-E329-4233-A00B-5EA794D06066}.exe 2124 {A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe 1236 {7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe 2588 {98425FC2-9954-4844-B6DA-6E617E0F6D05}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe {A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe File created C:\Windows\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe {F897AE52-9247-4857-B642-F195214BD8A5}.exe File created C:\Windows\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe File created C:\Windows\{51E0C171-92DF-4a92-9072-C79138278B0C}.exe {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe File created C:\Windows\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe File created C:\Windows\{D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe File created C:\Windows\{BAF69FB7-E329-4233-A00B-5EA794D06066}.exe {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe File created C:\Windows\{F897AE52-9247-4857-B642-F195214BD8A5}.exe 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe File created C:\Windows\{36D049AE-D479-4b58-BA35-2B1D580BD761}.exe {51E0C171-92DF-4a92-9072-C79138278B0C}.exe File created C:\Windows\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe {BAF69FB7-E329-4233-A00B-5EA794D06066}.exe File created C:\Windows\{98425FC2-9954-4844-B6DA-6E617E0F6D05}.exe {7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe Token: SeIncBasePriorityPrivilege 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe Token: SeIncBasePriorityPrivilege 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe Token: SeIncBasePriorityPrivilege 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe Token: SeIncBasePriorityPrivilege 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe Token: SeIncBasePriorityPrivilege 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe Token: SeIncBasePriorityPrivilege 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe Token: SeIncBasePriorityPrivilege 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe Token: SeIncBasePriorityPrivilege 1556 {BAF69FB7-E329-4233-A00B-5EA794D06066}.exe Token: SeIncBasePriorityPrivilege 2124 {A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe Token: SeIncBasePriorityPrivilege 1236 {7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1800 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 28 PID 1916 wrote to memory of 1800 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 28 PID 1916 wrote to memory of 1800 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 28 PID 1916 wrote to memory of 1800 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 28 PID 1916 wrote to memory of 1692 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 29 PID 1916 wrote to memory of 1692 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 29 PID 1916 wrote to memory of 1692 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 29 PID 1916 wrote to memory of 1692 1916 2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe 29 PID 1800 wrote to memory of 3012 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 30 PID 1800 wrote to memory of 3012 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 30 PID 1800 wrote to memory of 3012 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 30 PID 1800 wrote to memory of 3012 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 30 PID 1800 wrote to memory of 2684 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 31 PID 1800 wrote to memory of 2684 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 31 PID 1800 wrote to memory of 2684 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 31 PID 1800 wrote to memory of 2684 1800 {F897AE52-9247-4857-B642-F195214BD8A5}.exe 31 PID 3012 wrote to memory of 2600 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 32 PID 3012 wrote to memory of 2600 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 32 PID 3012 wrote to memory of 2600 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 32 PID 3012 wrote to memory of 2600 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 32 PID 3012 wrote to memory of 2808 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 33 PID 3012 wrote to memory of 2808 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 33 PID 3012 wrote to memory of 2808 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 33 PID 3012 wrote to memory of 2808 3012 {76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe 33 PID 2600 wrote to memory of 2488 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 36 PID 2600 wrote to memory of 2488 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 36 PID 2600 wrote to memory of 2488 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 36 PID 2600 wrote to memory of 2488 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 36 PID 2600 wrote to memory of 2556 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 37 PID 2600 wrote to memory of 2556 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 37 PID 2600 wrote to memory of 2556 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 37 PID 2600 wrote to memory of 2556 2600 {ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe 37 PID 2488 wrote to memory of 2172 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 38 PID 2488 wrote to memory of 2172 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 38 PID 2488 wrote to memory of 2172 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 38 PID 2488 wrote to memory of 2172 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 38 PID 2488 wrote to memory of 1736 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 39 PID 2488 wrote to memory of 1736 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 39 PID 2488 wrote to memory of 1736 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 39 PID 2488 wrote to memory of 1736 2488 {51E0C171-92DF-4a92-9072-C79138278B0C}.exe 39 PID 2172 wrote to memory of 276 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 40 PID 2172 wrote to memory of 276 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 40 PID 2172 wrote to memory of 276 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 40 PID 2172 wrote to memory of 276 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 40 PID 2172 wrote to memory of 2468 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 41 PID 2172 wrote to memory of 2468 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 41 PID 2172 wrote to memory of 2468 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 41 PID 2172 wrote to memory of 2468 2172 {36D049AE-D479-4b58-BA35-2B1D580BD761}.exe 41 PID 276 wrote to memory of 1960 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 42 PID 276 wrote to memory of 1960 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 42 PID 276 wrote to memory of 1960 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 42 PID 276 wrote to memory of 1960 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 42 PID 276 wrote to memory of 2292 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 43 PID 276 wrote to memory of 2292 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 43 PID 276 wrote to memory of 2292 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 43 PID 276 wrote to memory of 2292 276 {A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe 43 PID 1960 wrote to memory of 1556 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 44 PID 1960 wrote to memory of 1556 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 44 PID 1960 wrote to memory of 1556 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 44 PID 1960 wrote to memory of 1556 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 44 PID 1960 wrote to memory of 2408 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 45 PID 1960 wrote to memory of 2408 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 45 PID 1960 wrote to memory of 2408 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 45 PID 1960 wrote to memory of 2408 1960 {D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_83e7ec18f0949f9c29932aa12a831797_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\{F897AE52-9247-4857-B642-F195214BD8A5}.exeC:\Windows\{F897AE52-9247-4857-B642-F195214BD8A5}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exeC:\Windows\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exeC:\Windows\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\{51E0C171-92DF-4a92-9072-C79138278B0C}.exeC:\Windows\{51E0C171-92DF-4a92-9072-C79138278B0C}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\{36D049AE-D479-4b58-BA35-2B1D580BD761}.exeC:\Windows\{36D049AE-D479-4b58-BA35-2B1D580BD761}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exeC:\Windows\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\{D4E8297F-93CC-4e91-B64A-F2350D823F15}.exeC:\Windows\{D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{BAF69FB7-E329-4233-A00B-5EA794D06066}.exeC:\Windows\{BAF69FB7-E329-4233-A00B-5EA794D06066}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exeC:\Windows\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exeC:\Windows\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\{98425FC2-9954-4844-B6DA-6E617E0F6D05}.exeC:\Windows\{98425FC2-9954-4844-B6DA-6E617E0F6D05}.exe12⤵
- Executes dropped EXE
PID:2588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DFF1~1.EXE > nul12⤵PID:948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7BAB~1.EXE > nul11⤵PID:484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAF69~1.EXE > nul10⤵PID:2332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4E82~1.EXE > nul9⤵PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0F75~1.EXE > nul8⤵PID:2292
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36D04~1.EXE > nul7⤵PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51E0C~1.EXE > nul6⤵PID:1736
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED5F4~1.EXE > nul5⤵PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76D1D~1.EXE > nul4⤵PID:2808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F897A~1.EXE > nul3⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
- Deletes itself
PID:1692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{36D049AE-D479-4b58-BA35-2B1D580BD761}.exe
- Size 408KB
- SHA256 9c504a5844aa577980ac143a6a6494668ee036d737cc65e014450cbbedacd097
- MD5 6657f9a8ee12c544815e1a9a9763f335
- SHA1 3f7d8b2f54dd1d207350fecd88ecb905a2071ba1
- SHA512 aa0d4c5e1796cf5551e26bfd37683b23ff545eee289c4f43d8ec1ff2a09a5075b74f4a05a75ef2445d11e0e2ff12286e4aad642ccb299a3d51e2506b036d8355
- SSDEEP 3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGGldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{51E0C171-92DF-4a92-9072-C79138278B0C}.exe
- Size 408KB
- SHA256 99ddbfa1ddabda8cf651d121cba0529c4d131a8de8c2b112caf94e5f73299236
- MD5 24e4b31aced9436a6847f7d6b024f020
- SHA1 309da6e2a0136130b72f7b44c440e06d9c8a49bc
- SHA512 c440e07ff2ed465c95047c8dd776fdfa9b51efea19d200111198d3cc5834c91a4d67a82866055d0f8c9ffa74cfe5398f0d7dc4e7b27599ab46aba51461135e6f
- SSDEEP 3072:CEGh0o3l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGNldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{76D1D2DD-7AFD-4c44-878E-48FF4CC52303}.exe
- Size 408KB
- SHA256 2a7421e416ab8fa5c8cd2c43965cb3e42f932b87b12354c1330fab034593d1a8
- MD5 6003b142fd33d60c27530f3cfbb9c631
- SHA1 3e0fe4b9a990d8a8150de45053ab63a9412ccbee
- SHA512 d78a3cf82fc7488d5d23b35af47bd1eb53a5544a291a6b9d5be95be87b12d147a7dd645a6c0b83aa6fdb54d67eee7e1335f199dcf953421631b90c32d8c69285
- SSDEEP 3072:CEGh0owl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGOldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{7DFF1F85-FF9A-4e60-B485-57A65A4ACFC8}.exe
- Size 408KB
- SHA256 86f971d44fbb5bb56d6853fcb40f9904190e2cf42500f736df4fd6e9100f3d62
- MD5 283d8617f180c63ba010eaba04e81000
- SHA1 8068b4c38435fd94a81bb62608553087f425f39d
- SHA512 06e8374f2e84ec15f6b6402e5fc10eb2235bf56cef557627c3943bd1ead05a5e3f5029eb8b3627bac142c96a0bd01110d74582bf1ec873b2adbae99380e4bc65
- SSDEEP 3072:CEGh0ojl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG1ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{98425FC2-9954-4844-B6DA-6E617E0F6D05}.exe
- Size 408KB
- SHA256 139257a90b6cc4f892c3f3148ed5a113964106c60d9e8ef44e74d0124c6bac36
- MD5 6af171b2aca46240c1816b4ecce52cda
- SHA1 2a53423ce9cfcacbf35f79fb497184ffe2425c20
- SHA512 63c277df948ba149f84c4035780bcc6a70b0c5fb98b280af5dd53bbf5e6570beccf29334d57edeb0636e3dab87f7a2a3391c2fabc28c4e84c7913006341469e5
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGuldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A0F754B3-5B99-49eb-B2AF-509AB24EB6D6}.exe
- Size 408KB
- SHA256 ab4df283d4795ef2c7fe5e74e8a95ce91d6f49b385e1140c8ee272e9f2ecb60c
- MD5 cfdd743e4d9bfd473f3fa654c3ea7e20
- SHA1 27ee08b790c7ec0ff8ebcceb9334189254157cb9
- SHA512 16529366fa03e4cc7a74f0cc5920a80a4ba1cf873a393ef91f9f05b02f7b4d4245b2946095726fe330c22fe12976e61e6f14b5780edc880444176c2cf554a72b
- SSDEEP 3072:CEGh0oGl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A7BABA1F-5B31-4f25-8E38-39816B5707C4}.exe
- Size 408KB
- SHA256 c7c0b5a64971a46a6563282191b478281d101b9a5a88ebf557e6d002187903a5
- MD5 34f58e6a21e233f5f343550b0104bd3f
- SHA1 b11aba323fb8bd874212b848197dcc6914af04b8
- SHA512 0916e3256ad2e07fbdf39eb89b1dcd600be9c759db2e01480787e81664036e1ad92f280f53ad157fed2505d64c4ad66b6d66a21c7a1447504b5abf08a2324ed5
- SSDEEP 3072:CEGh0oel3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGQldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BAF69FB7-E329-4233-A00B-5EA794D06066}.exe
- Size 408KB
- SHA256 a2dcf31e4910321ae10e524853882a31f1af40478cfd705a2b209f44cf456aaf
- MD5 4cfac93b0e49397b67e36dd031b607d3
- SHA1 cebe9f6979f71c72a994d5ab2e4189dde9aee86c
- SHA512 999633036f26bb260c943ffffa24fcc0f1349f76843029dff932e0667553bfec51fad806275aa2950f380efb5ee6f910b7e6e04c02f14539c8a8350b307998d3
- SSDEEP 3072:CEGh0oMl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGKldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{D4E8297F-93CC-4e91-B64A-F2350D823F15}.exe
- Size 408KB
- SHA256 5565e290cb22ce6cf54e4c3915a94e7d3322fba1991adc9c5019741aa42b649b
- MD5 5aca3f4ab1b690ae62abc933319eade7
- SHA1 ed46ef59a0a55df9549133f08fe6e8e6ba281378
- SHA512 e5afb8ac2f1a3c6f4fc5b4fd9fa4b70a8d89f999ab43a9194341f3bc5f043639b0341bd10333507e388e724dc78670731c48d20f88cc5d1af6b5e3f2b7ae1b96
- SSDEEP 3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGGldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{ED5F4092-F0D8-4228-9B7F-2A64030E7049}.exe
- Size 408KB
- SHA256 1851c12d3a1326f97c29f13936641eee5403b4be0eb61026ad2830b89d9fae05
- MD5 0483cbdb7da22ca39d030515be4c64b1
- SHA1 c35e5aec152899ce33d12e97e9140bc5cf70a7ee
- SHA512 2d645af81b6533f86cca7fed0b0724a71f50b430fa4c078b05e0b9a14bbdd75bb2b3b1383ff13811dd0863d0e3a796367a56561f490485afb62d940c64ef11b1
- SSDEEP 3072:CEGh0oul3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F897AE52-9247-4857-B642-F195214BD8A5}.exe
- Size 408KB
- SHA256 c39c6f9a4091a62c954cb6ce2a451563c16b6833b7a920d29e65cbc7601d8ee0
- MD5 cc9f410742f59c376e0bc7be2e5d1632
- SHA1 615e731c4e7f9fb20ac91d4cad655ab9bc426280
- SHA512 d038e0db2d8a5ffc6d2cd6b623d544545b896def8e60af12cc66b3343b22cd0ce2c8097e0ffb8c7f117abe010af3cd011cc4efd30d2924932ec1b270b4dba866
- SSDEEP 3072:CEGh0o9l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGTldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP